Update information on CVE-2019-20164

gpac in experimental is affected, so when gpac maintainers will upload a
new version to unstable, it should be one containing the fix to not open
the CVE for unstable.